Week of March 31, 2025: Ivanti Zero-Day Alert and Fast Flux Threat Advisory

Security leaders tracked an actively exploited Ivanti Connect Secure vulnerability and a multi-agency warning on fast-flux infrastructure during the week of March 31, 2025, while CISA added Cisco Smart Licensing Utility and Apache Tomcat flaws to its Known Exploited Vulnerabilities Catalog. The week also brought new CISO appointments at ESET and Commvault and five industrial control systems advisories covering Hitachi Energy, ABB, and B&R products.

ESET and Commvault Name New Security Executives

SecurityWeek's Industry Moves roundup for the week of March 31, 2025, reported several cybersecurity leadership changes. ESET named Charles (Chuck) Everette as Field Chief Information Security Officer for its Corporate Solutions business in North America, serving Fortune 500 clients. Commvault appointed Bill O'Connell as Chief Security Officer, following his role as Global Head of Cybersecurity and Privacy at Roche. The same roundup noted CrowdStrike's return of founding architect Alex Ionescu as Chief Technology Innovation Officer and Trulioo's naming of Vicky Bindra as CEO. (SecurityWeek)

Ivanti Patches Actively Exploited Connect Secure Flaw

Ivanti released security updates addressing CVE-2025-22457, a stack-based buffer overflow in Connect Secure, Policy Secure, and ZTA Gateways products that a cyber threat actor could exploit to take control of an affected system. CISA added the flaw to its Known Exploited Vulnerabilities Catalog on April 4, 2025, and urged organizations that had not patched Connect Secure by February 28, 2025, to conduct threat hunting, consider factory resets, and apply patches, noting that fixes for ZTA Gateways and Policy Secure were not due until April 19 and 21. (CISA)

CISA Flags Actively Exploited Apache Tomcat Flaw

CISA added CVE-2025-24813, an Apache Tomcat path equivalence vulnerability, to its Known Exploited Vulnerabilities Catalog on April 1, 2025, citing evidence of active exploitation. The agency said such vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog vulnerabilities by set deadlines, and CISA urged all organizations to prioritize timely remediation as part of routine vulnerability management practices. (CISA)

Cisco Smart Licensing Utility Flaw Added to KEV Catalog

CISA added CVE-2024-20439, a static credential vulnerability in Cisco Smart Licensing Utility, to its Known Exploited Vulnerabilities Catalog on March 31, 2025, based on evidence of active exploitation. The addition fell under Binding Operational Directive 22-01, which requires Federal Civilian Executive Branch agencies to remediate catalog vulnerabilities by specified due dates. CISA reiterated that while the directive applies only to federal agencies, all organizations should prioritize timely remediation of catalog vulnerabilities in their vulnerability management programs. (CISA)

CISA Issues Five ICS Advisories for Hitachi Energy, ABB, B&R

CISA released five Industrial Control Systems advisories on April 3, 2025, covering Hitachi Energy's RTU500 Series and TRMTracker products, ABB's ACS880 Drives and Low Voltage DC Drives and Power Controllers containing CODESYS RTS, and B&R's APROL platform. The advisories detailed current security issues, vulnerabilities, and exploits surrounding the affected systems, and CISA encouraged users and administrators to review the technical details and apply the recommended mitigations for each product line. (CISA)

CISA, NSA, FBI, and Allies Warn on Fast Flux Infrastructure

CISA joined the NSA, FBI, and cybersecurity agencies from Australia, Canada, and New Zealand on April 3, 2025, to release a joint advisory on fast flux, warning that the technique lets malicious actors rapidly change DNS records to hide command-and-control infrastructure. The advisory said fast flux networks create resilient adversary infrastructure used in phishing, botnet command and control, and data exfiltration, and urged internet service providers and Protective DNS providers to develop detection and blocking capabilities. (CISA)